Earlier quoted context omitted.
Exactly. Retrospective laws like that would face stiff opposition.
Ex post facto laws should be prohibited in any civilized country.
What would make it an ex post facto law is if companies were punished for how they handled data before the law was created. It is perfectly reasonable to punish them if they continue that same behavior after the law was created.